This vulnerability (CVE-2026-57696) affects videowhisper Picture Gallery up to version 1.6.5 and involves improper limitation of a pathname to a restricted directory (CWE-22). It allows an authenticated contributor to delete arbitrary files on the server by exploiting a path traversal flaw. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low complexity, required privileges (low), no user interaction, unchanged scope, no confidentiality impact, integrity impact (file deletion), and high availability impact. No patch or official remediation level has been published yet.

An attacker with contributor-level privileges can delete arbitrary files on the server hosting the Picture Gallery application. This can disrupt service availability and potentially cause denial of service. There is no reported confidentiality impact. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor permissions and monitor for suspicious file deletion activities. Avoid exposing the application to untrusted networks if possible.